AT A GLANCE
Fake AI-event invitations offer premium access in exchange for a Microsoft or Google sign-in. The attacks can steal authenticated sessions or access tokens and defeat some MFA protections. A genuine sign-in page can still lead to the wrong outcome..... verify the event and the request.
An invitation to an OpenAI, SpaceX or Anthropic event, with free premium AI access thrown in..... just sign in with your Microsoft or Google work account...... what could go wrong????
Criminals are using convincing registration pages to turn that tempting offer into account theft.
There is some dark humour here. Researchers point out that AI makes convincing fake pages easier to create, while enthusiasm for AI supplies the bait.
These sites even ask visitors to prove they are not robots..... before finding out how easily the humans can be fooled!
BUT..... this goes beyond stealing a password. The attacks can capture account access tokens or authenticated sessions, defeating some MFA protections.
A victim can even reach Microsoft’s GENUINE sign-in page and be persuaded to authorise the attacker’s session.
Familiar surroundings..... entirely the wrong outcome!
Once again, the human remains the weakest link. A familiar logo and an attractive freebie can cloud otherwise sensible judgement.
Verify events through the organiser’s official website, never enter device codes supplied by an unverified invitation, and report suspicious requests immediately.
THE SOURCE / FURTHER READING
Want the full feature?
You’ve read the TOP STORIES interpretation. Continue to the publisher for the source feature or detailed guidance.
Read the original feature at BleepingComputer (opens a new tab)